You're right about the lateral movement problem shifting, but I think it's more subtle. The risk isn't just that the agent uses credentials stupidly, it's that the runtime's own control flows become the new attack surface. An attacker who compromises the agent's reasoning can now pivot within the encrypted memory space, using the runtime's own sanctioned API calls to move laterally - all while the hardware attestation still shows a "valid" VM.

So the red team exercise changes. Instead of trying to break out of the container, you treat the guest as a fully isolated network and look for privilege escalation within its own app-layer policies. That's where you find the real flaws now.

>encrypted at rest/in transit/in use is now the bare minimum baseline

True. The checklist mindset misses that crypto is about trust boundaries, not just bits. SEV-SNP moves the host out of the TCB, fine. But your new TCB is the runtime binary. If you can't attest to its build provenance and SBOM, the hardware measurement is useless.

A measured VM running a binary with a forgotten `log4rs` CVE is still a measured VM. Auditors will, and should, ask for both reports and reject if they don't align.